Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ba951841 authored by Jens Axboe's avatar Jens Axboe
Browse files

[BLOCK] blk_rq_map_sg() next_sg fixup 



Don't ever use sg_next() on the last entry, it may not be valid!

Signed-off-by: default avatarJens Axboe <jens.axboe@oracle.com>
parent a3bec5c5

block/ll_rw_blk.c

+6 −4
Original line number Original line Diff line number Diff line
@@ -1322,8 +1322,8 @@ int blk_rq_map_sg(struct request_queue *q, struct request *rq, 
		  struct scatterlist *sglist)

		  struct scatterlist *sglist)

{

{

	struct bio_vec *bvec, *bvprv;

	struct bio_vec *bvec, *bvprv;

	struct scatterlist *next_sg, *sg;

	struct req_iterator iter;

	struct req_iterator iter;

	struct scatterlist *sg;

	int nsegs, cluster;

	int nsegs, cluster;





	nsegs = 0;

	nsegs = 0;
@@ -1333,7 +1333,7 @@ int blk_rq_map_sg(struct request_queue *q, struct request *rq, 
	 * for each bio in rq

	 * for each bio in rq

	 */

	 */

	bvprv = NULL;

	bvprv = NULL;

	sg = next_sg = &sglist[0];

	sg = NULL;

	rq_for_each_segment(bvec, rq, iter) {

	rq_for_each_segment(bvec, rq, iter) {

		int nbytes = bvec->bv_len;

		int nbytes = bvec->bv_len;
@@ -1349,8 +1349,10 @@ int blk_rq_map_sg(struct request_queue *q, struct request *rq, 
			sg->length += nbytes;

			sg->length += nbytes;

		} else {

		} else {

new_segment:

new_segment:

			sg = next_sg;

			if (!sg)

			next_sg = sg_next(sg);

				sg = sglist;

			else

				sg = sg_next(sg);





			memset(sg, 0, sizeof(*sg));

			memset(sg, 0, sizeof(*sg));

			sg->page = bvec->bv_page;

			sg->page = bvec->bv_page;